#{MARK}|DPort=$14|Proto=$8,,1|SPort=$16|DIP=$12|SIP=$13|DevID=$4|DevTime=$1|RawEventName=$4|RawID=$6|RawLevel=$10|Level=$10,,1|EventType=$19,,1|DevIP=$11|DevIPV6={DEVIP}|DevType={DEVTYPE}|Purpose=4|Count=1|Result=3|LongComment={RAW}
import  re
class ActionExtractor(object):
    autoDic001 = {'SPort':'SrcPort',
                  'DPort':'DstPort',}       #for renzixing

    def __init__(self):
        self.curTagDict = {}

    def __get_curTagDict(self, buff):
        m_before_equal = re.findall('\S+(?==)', buff)
        i = 1
        for tags in m_before_equal:
            self.curTagDict[tags] = i
            i = i + 1

    def autoAct(self,buff, num = 1):
        self.__get_curTagDict(buff)

        strlist = []
        index = 0
        if num == 1:
            for (k,v) in ActionExtractor.autoDic001.items():
                if self.curTagDict.get(v) is not None:
                    index = int(self.curTagDict.get(v))
                    strlist.append(k + '=$' + str(index) + '|')
        strbuf = ''.join(strlist)

        #remove the last '|'
        strbuf = strbuf[0:len(strbuf)-1]

        return strbuf


    def manualAct(self,buff):
        self.__get_curTagDict(buff)
        print(self.curTagDict)
